Set session length for Google Cloud services

You can control how long users can access the Google Cloud console, the Cloud SDK (Cloud CLI), and any third-party or internal apps that require user authorization for Google Cloud scopes before they have to sign in again. For example, you might require users with elevated privileges, such as project owners or billing administrators, to sign in more often than regular users. You can set different session lengths for these departments or groups. When their session expires, they're prompted to sign in again to start a new session.

Exceptions to the setting

If you set up a session length for users, it doesn't apply to the Google Cloud mobile app. There are also limitations in the Google Cloud console. To apply a session length to all Google web services, you can also set a session length for Google services, such as Gmail on the web. For details, go to Set session length for Google services.

Before you begin

  • Prepare for a broad rollout—When you set the session length, it applies to all Google and third-party apps that require Google Cloud scopes. Before rolling out the policy broadly, test how it works for each app with a small group of users. To review the apps used in your organization, go to Control which third-party & internal apps access Google Workspace data and filter for the Google Cloud service.
  • Exempt apps that can't reauthenticate—Some apps don't handle reauthentication well and might crash. Or, they might run server-to-server with user credentials instead of a service account, where no user is present to sign in. To prevent disruptions, you can exempt specific apps from session-length limits while keeping session controls on for other Google Cloud services. Add the apps to your trusted apps list and then exempt them when you set the session length.

Set the reauthentication (session length) policy

If you require a security key to sign in, users without one can't use the Google Cloud console or Cloud SDK until they set one up. After they set up a security key, they can switch to using their password if needed.

Before you begin: If you need to set up a department or team for this setting, go to Add an organizational unit.

  1. In the Google Admin console, go to Menu and then Security and then Access and data control and then Google Cloud session control.

    Requires having the Security Settings administrator privilege.

  2. (Optional) To apply the setting to a department or team, at the side, select an organizational unit.

  3. For Reauthentication policy, select Require reauthentication and from the Reauthentication frequency list, select a frequency.

    The minimum frequency allowed is 1 hour, and the maximum is 24 hours. The frequency doesn't include how long a user has been inactive in the session. It is the fixed time that elapses before the user needs to sign in again.

  4. (Optional) To exempt trusted apps from reauthentication, check the Exempt Trusted apps box.

  5. For Reauthentication method, select Password or Security key to specify how users must sign in.

  6. Click Save. Or, you might click Override for an organizational unit.

    To later restore the inherited value, click Inherit.

Changes can take up to 24 hours but typically happen more quickly. Learn more

If users get a reauth related error response from third-party apps after a session expires, they can sign in to the app again to start a new session.

Apps using Application Default Credentials with user credentials are considered third-party apps and might also return a reauth related error response. To get new credentials and authorize the app again, users can run the gcloud auth application-default login command.

How reauthentication works with a third-party IdP

  • Google Cloud console—If you require users to sign in with their password, they're redirected to your identity provider (IdP) to reauthenticate. If a user already has an active IdP session from another app, the IdP might not require them to enter their password again. If you require users to sign in with a security key, they can tap their security key while using the console. They aren't redirected to the IdP.
  • Cloud SDK—If you require users to sign in with a password, users need to run the gcloud auth login command to renew a session. If they don't have an active IdP session, they might be prompted to sign in again. If you require users to sign in with a security key, they can tap their security key in Cloud SDK. They aren't redirected to the IdP.